diff options
| author | Damien Miller <djm@cvs.openbsd.org> | 2017-08-11 04:47:13 +0000 |
|---|---|---|
| committer | Damien Miller <djm@cvs.openbsd.org> | 2017-08-11 04:47:13 +0000 |
| commit | df7f015e20610f5f9a3025ee3f5917bfbb87c611 (patch) | |
| tree | 4aff7569aaefe5c294733fbd8ce097fd436463c8 /usr.bin | |
| parent | 5f3bb8a1f197b2f1cec1e099995eeeee6555dd40 (diff) | |
refuse to a private keys when its corresponding .pub key does not
match. bz#2737 ok dtucker@
Diffstat (limited to 'usr.bin')
| -rw-r--r-- | usr.bin/ssh/sshconnect2.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/usr.bin/ssh/sshconnect2.c b/usr.bin/ssh/sshconnect2.c index 3a70ebbeec4..0d95bb71628 100644 --- a/usr.bin/ssh/sshconnect2.c +++ b/usr.bin/ssh/sshconnect2.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshconnect2.c,v 1.264 2017/06/14 00:31:38 dtucker Exp $ */ +/* $OpenBSD: sshconnect2.c,v 1.265 2017/08/11 04:47:12 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * Copyright (c) 2008 Damien Miller. All rights reserved. @@ -1029,6 +1029,11 @@ identity_sign(struct identity *id, u_char **sigp, size_t *lenp, /* load the private key from the file */ if ((prv = load_identity_file(id)) == NULL) return SSH_ERR_KEY_NOT_FOUND; + if (id->key != NULL && !sshkey_equal_public(prv, id->key)) { + error("%s: private key %s contents do not match public", + __func__, id->filename); + return SSH_ERR_KEY_NOT_FOUND; + } ret = sshkey_sign(prv, sigp, lenp, data, datalen, key_sign_encode(prv), compat); sshkey_free(prv); |